Security audit
Security checks across malware telemetry and agentic risk
This diagram skill is mostly transparent about being paid, but it can automatically contact an external billing service and charge before the user has confirmed the work.
Install only if you deliberately want a paid SkillPay-backed diagram skill. Verify the SkillPay account identity before use, do not rely on the anonymous_user fallback, require explicit confirmation before every paid generation, and run LaTeX/diagram generation in an isolated environment with pinned dependencies.
# ② Charge per call / 每次调用扣费
def charge_user(user_id: str) -> dict:
resp = requests.post(
f'{BILLING_API_URL}/api/v1/billing/charge',
headers=HEADERS,
json={# ③ Generate payment link / 生成充值链接
def get_payment_link(user_id: str, amount: float) -> str:
resp = requests.post(
f'{BILLING_API_URL}/api/v1/billing/payment-link',
headers=HEADERS,
json={'user_id': user_id, 'amount': amount}HEADERS = {'X-API-Key': BILLING_API_KEY, 'Content-Type': 'application/json'}
def charge_user(user_id: str) -> dict:
resp = requests.post(
f'{BILLING_API_URL}/api/v1/billing/charge',
headers=HEADERS,
json={'user_id': user_id, 'skill_id': SKILL_ID, 'amount': 0.001}HEADERS = {'X-API-Key': BILLING_API_KEY, 'Content-Type': 'application/json'}
def charge_user(user_id: str) -> dict:
resp = requests.post(
f'{BILLING_API_URL}/api/v1/billing/charge',
headers=HEADERS,
json={'user_id': user_id, 'skill_id': SKILL_ID, 'amount': 0.001}HEADERS = {'X-API-Key': BILLING_API_KEY, 'Content-Type': 'application/json'}
def charge_user(user_id: str) -> dict:
resp = requests.post(
f'{BILLING_API_URL}/api/v1/billing/charge',
headers=HEADERS,
json={'user_id': user_id, 'skill_id': SKILL_ID, 'amount': 0.001}HEADERS = {'X-API-Key': BILLING_API_KEY, 'Content-Type': 'application/json'}
def charge_user(user_id: str) -> dict:
resp = requests.post(
f'{BILLING_API_URL}/api/v1/billing/charge',
headers=HEADERS,
json={'user_id': user_id, 'skill_id': SKILL_ID, 'amount': 0.001}os.makedirs(output_dir, exist_ok=True)
# 编译 LaTeX
result = subprocess.run(
["pdflatex", "-output-directory", output_dir, tex_file],
capture_output=True, text=True
)66/66 vendors flagged this skill as clean.
No suspicious patterns detected.